Four pillars
What Treasure specifically offers
At Treasure, compliance is not a marketing promise, but an architectural decision.
Processing in the EU
Platform and storage run on AWS in Frankfurt; AI processing runs via EU regions of AWS, Google and Microsoft. The provider is the German company boutiq ai GmbH.
No training with your data
We do not use client or contract data to train AI models.
GDPR + BRAO + §203 StGB
The architecture is designed to meet German and EU data protection requirements. We provide the AV contract, technical and organizational measures (TOMs) and processing directory as standard.
ISO 27001 certified
Information security management and processes are ISO 27001 certified — auditable and documented for your supplier audit.
This way your data is protected
Six layers of protection
From transport to tenant separation — security on several levels.
TLS 1.3
Encryption in transit
AES-256
Encryption at rest
RBAC + SSO
granularly controlled
AI in EU regions
no model training
Audit trail
immutable versions
Tenant separation
own database schema
Transportation · Step 1 of 6
TLS 1.3
All connections to Treasure run over TLS 1.3 with modern cipher suites. Deprecated protocols are disabled.
Network
Storage · Step 2 of 6
AES-256
All stored contract data is encrypted with AES-256.
Storage
Access · Step 3 of 6
RBAC + SSO
Role and permission model, SSO via Microsoft Entra ID (OIDC), two-factor authentication (TOTP, passkeys) that can be made mandatory per tenant.
Access
AI processing · Step 4 of 6
AI in EU regions
AI processing runs via EU regions of AWS (Bedrock), Google (Vertex AI) and Microsoft (Azure OpenAI). Your data is not used for training. The model can be selected per tenant and per task.
AI
Audit · Step 5 of 6
Audit trail
The audit trail covers documents, matters, chats, flows, playbooks, approvals and login events, with CSV export. Document versions are immutable.
Audit
Separation · Step 6 of 6
Tenant separation
Each tenant has its own database schema. Data of different customers is kept separate.
Tenant
Specifically for in-house lawyers
Designed for BRAO and § 203 StGB
What matters particularly for lawyers and legal departments in Germany (our own assessment, not legal advice).
Obligation of confidentiality
§ 43a para. 2 BRAO: In Treasure, tenants are separated at database schema level; access is governed by a role and permission model and logged in the audit trail.
§ 203 StGB
Treasure is designed to be engaged as a contributing person within the meaning of Section 203 of the German Criminal Code (our own assessment): data processing agreement, written confidentiality obligation of employees, clearly defined responsibilities.
Client separation
Data separation at database schema level: no cross-tenant learning, no shared data pools. What your system learns from your contracts remains solely yours.
Safety documentation
Test us — as deeply as you want.
Read the documentation or speak to our CTO directly. You choose the depth.
Recommended
Security documentation as PDF
Security whitepaper, hosting architecture, AV contract template, ISO status — everything your data protection and IT audit needs.
Request documentation →Direct download after email request
Tech deep dive with the CTO
30-minute call with Moritz Biersack (CTO, Boutiq AI GmbH): Architecture, threat model, your specific questions — without sales filters.
Book a call with the CTO →Directly with the founding team
FAQ
Frequently asked questions
Where is our data hosted?
Processing in EU data centres: platform and storage on AWS in Frankfurt, AI via EU regions of AWS, Google and Microsoft. The provider is the German company boutiq ai GmbH, based near Munich.
Are our contracts used to train AI models?
No. Your client and contract data is not used to train models. Your playbooks and rules apply only within your own tenant; none of it flows to other customers.
How does Treasure fit into the EU AI Act?
Treasure is designed for traceability and human oversight: AI results are shown with source passage and reasoning and recorded in the audit trail, people make the final decisions, and the processing is described transparently. You introduce AI — with a use case that is auditable from the start.
What does Section 203 StGB mean for our work?
Persons subject to professional secrecy may involve assistants if they are contractually obliged to maintain confidentiality. Treasure is designed for this (our own assessment): data processing agreement, confidentiality obligation of employees, tenant separation at database schema level. We provide the appropriate contract documents as standard.
Can we withdraw after signing up?
Yes. There is a 4-week unconditional right of withdrawal with full refund. On request, your data is deleted after the end of the contract.